Details

The ability to specify custom status messages opens up the potential for additional headers to be injected. If custom header status messages are required make sure it is only in US-ASCII and does not include any user-supplied data.

Rationale:

Allowing user-supplied data into a header creates the potential for cross-site scripting (XSS).

Solution

To start Tomcat with USE_CUSTOM_STATUS_MSG_IN_HEADER set to false, add -Dorg.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER=false to your startup script.

Default Value:

By default this is set to false.

References:

https://tomcat.apache.org/tomcat-8.0-doc/config/systemprops.html

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/2506

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6
• CSCv7|5.1

Source

• Tenable.com/audits